IX plan for log enrichment

All

Release notes and notices

SR: Please include the plans for the enhancement blurb.

SM: Sure. I had forgotten to include it here.

2022 enhancements

Enrich logs with external data

SR: "Enriching log messages with external data"

Are they enriching the logs, log messages, log records, or log events?

Enriching logs makes it sound like they are changing the log source. It that is the case, then okay.

Admin/Operator

Enriching logs for enhanced diagnostics

Process overview

SR: "Enriching log messages [for monitoring]"

SM: I will confirm it with the PM. It is to make logs more meaningful.

SR: "...for enhanced diagnostics" is good, but are they enriching the logs, log messages, or log events?

SR: Please add the subheadings for the entire plan.

You don't need a subheading if you have a single task title, but do specify them if you have multiple sections. Follow the model for tasks.

SM: Done

Obtaining the JSON format of a log message

Task

I have added this topic at this location because the steps would be applicable for both Adding enrichment sources and Configuring enrichment policy topics

SR: If it is a task, you need a gerund title.

The current title does not identify what this is about. Is there any way you can bring out the context? Is this about gathering information for log enrichment?

SM: Done

The location is fine.

Thanks!

Admin/Operator

Adding enrichment sources

None

Process overview

None

SR: "Defining log enrichment sources"

Any time you have a parent topic, it serves as navigation for child topics. See the model for process overviews on choices for formatting this page.

SM: Please let me bring up a point. Users can add multiple enrichment sources. While defining a policy, they can select multiple enrichment sources. So, I was thinking that Adding is suited. Please suggest.

SR: Okay. I guess I thought this branch would include defining the policy too.

Adding a CSV file as an enrichment source

Before you begin

To add CSV enrichment source

Task

SR: For all of these topics, you need to be more specific about the source in the title. Also, I'm not clear if they can have one source for each type or multiple sources of each type.  Use singular or plural appropriately.

"Adding a CSV file | CSV files as an enrichment source"

SM: I have changed all of them to singular.

Adding a DNS server as an enrichment source

Before you begin

To add DNS enrichment source

Task

None

SR: "Adding|Connecting to a DNS server as an enrichment source"

SM: It is not only connecting to the server. It is more about the information that we get from the server and add it to logs.

Adding an LDAP server as an enrichment source

Before you begin

To add LDAP enrichment source

Task

None

Adding a GeoIP server as an enrichment source

Before you begin

To add GeoIP enrichment source

Task

SR:  Is it GeoIP2? Google results show GeoIP as legacy. 

This term should go in a terminology sheet.

Adding IP Whitelist enrichment source

Before you begin

To add IP Whitelist enrichment source

Task

SR: Whitelist and blacklist are terms that the industry is moving away from. Reach out the editors to help with other choices you can share with your team.

SM: Sure. These are the terms used in the UI. However, the team is not taking it up in 22.1. When we take up these sources, we will work on having better terms.

Adding IP Blacklist enrichment source

Before you begin

To add IP Blacklist enrichment source

Task

Adding custom tags to logs

Before you begin

To add custom tags to logs

Task

As far as I understand, RnD might add this functionality to the Enrichment policy. I will be able to decide better about the use case when the policy UI is prepared.

Configuring policies to enrich logs

Before you begin

To add or modify a policy to enrich logs

To delete an enrichment policy

To enable or disable an enrichment policy (I am not sure about this topic yet)

Task

SR: "Configuring policies to enrich log events"

or

"Configuring log enrichment policies"

Because we have enrichment policies topics in other spaces, we want to have the word "log" in the title. I'd also do related topic links with current enrichment policies topic.

SM: I have changed the title. However, there is no existing enrichment policies topic. Which one are you mentioning? In other spaces as you mentioned? Please suggest.

SR: If this one is about defining the policy, then use that verb here.

Here are others:

Defining-event-policies-for-enrichment-correlation-notification-and-suppression

Not sure what the latest functionality is for TSOM

https://docs.bmc.com/docs/tsim105/creating-a-new-enrichment-policy-616456258.html